Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

This has nothing to do with "protection racket" and downvoters are going to be in for one hell of a reality check if you don't believe that this will happen.

Bounty hunters do this stuff for a living. If the company pays with $25 vouchers and the black market pays on the order of tens/hundreds of thousands, who do you think "these people" will go to?

I frankly don't believe you. I think you vastly overestimate how much you can sell a vulnerability for and vastly underestimate the morals of white hat hackers reporting bugs for a bounty.

There are close to zero companies that pay tens/hundreds of thousands for a bug, and yet clearly bounties are being paid and not 100% of bugs end up on the black market.

Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049)

Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discove...)

Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewa...)

Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.

Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.

I'd say: "Are these people concerned with receiving income for difficult, highly specialized, valuable work, or are they running a charity?" I guess it's a matter of perspective.

Not really. We have a system for ensuring that people get paid for valuable work: they're called contracts.

Yes, the market for security vulnerabilities is essentially a protection racket, and everyone knows it.